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Quantum key distribution (QKD) enables two parties to establish a secret key over a potentially 
hostile channel by exchanging photonic quantum states, relying on the fact that it is impossible 
for an eavesdropper to tap the quantum channel without disturbing these photons in a way that 
can be detected [T . Here we introduce a large- alphabet QKD protocol that makes optimal use of 
temporal and spectral correlations of entangled photons, reaching the maximum number of inde- 
pendent basis states (the Schmidt number) and enabling extremely high information content per 
photon together with an optimal rate of secret key generation. This protocol, which we call 'Dense 
Wavelength Division Multiplexed Quantum Key Distribution' (DWDM-QKD), derives its security 
by the conjugate nature of the temporal and spectral entanglement of photon pairs generated by 
spontaneous parametric down conversion. By using a combination of spectral and temporal bases, 
we can adjust the protocol to be resource efficient. We show that DWDM-QKD is well suited to 
approach the optimal key generation rate using present-day sources, detectors, and DWDM opti- 
cal networks from classical communications, as well as emerging optical interconnect and photonic 
integrated chip (PIC) systems. 



There has been growing interest in QKD schemes employing photons in high dimensional Hilbert 
spaces, resulting in a potentially very large-alphabet size [1, 2 . Different degrees of freedom have 
been considered, including temporal [3 , 4 and spatial modes [5 . Ultimately, the number of bits per 
photon is limited by the number of independent basis states spanning the Hilbert space, given by the 
Schmidt decomposition. While previous large-alphabet protocols in the temporal basis have reached 
up to 16 time bins [4 with a bit error rate of 5%, they were not able to reach the Schmidt number 
because, in practical situations, the detector timing jitter greatly exceeds the correlation time of 
entangled photons generated by typical spontaneous parametric down conversion (SPDC) sources. 
We overcome this limitation by employing temporal and spectral correlations simultaneously to 
match the performance of present-day detectors. Thus, given a certain detected-pair flux n and 
phase-matching bandwidth AQ^ the DWDM-QKD protocol proposed here allows two parties, Alice 
and Bob, to generate a secure key at the maximum rate possible in the time- frequency bases. In 
particular, DWDM-QKD enables Alice and Bob to generate their shared key at a maximum rate of 
n\og2{AQ/n). Here, ACl/n corresponds to the maximum number of independent time-frequency 
states in time interval of duration 1/n, and thus the maximum number of bits per photons is given 
by log2(Al]/n). 

We consider time-frequency entangled photon pairs with a correlation time acor produced by 
frequency-degenerate SPDC [6 , assuming a pump field at frequency Up with coherence time acoh- 
In the weak pumping limit, the down-converted photon pair can be approximated by the state 
1^) = J^oo I-oo^('^^^'^B)\tA,tB) dtAdtB, where ItA^ts) = a^(tA)aytB) |0), and a^^^(t^) denote 
the creation operators at time tj for Alice and Bob, and il^itA-ttB) is the normalized time-domain 
biphoton wave function. This state can be written equivalently in the spectral domain, 1^^^) = 
j"^^ j'^^^|){uJA,^B)\^A,^B) dujAduJB, where V^(cja,^b) = ^^2{^(tA,tB)} and FT2 denotes the 
two-dimensional Fourier transform. In these expressions, time and frequency represent conjugate 
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bases that can be employed to generate a secure key [2 . Specifically, we first discretize the biphoton 
state into rit orthogonal temporal basis states, |cr^^^), of duration (Juni given by WlinA^^linB) ~ 
p(2+i)crb^ri f^'^'^^'^^^'-'^ i/jftA^tB) ItA^tB) dtAdts^ and alternatively into orthogonal spectral basis 

states, of bandwidth given by u'^) = j/^*^^^'^'' liSu^'^^'' iIj{uja,ujb) \uja,^b) dujAduJu- We 
assume (75^^ > a cor and 5v > l/cicoh- and are bounded by the Schmidt number, K = ritn^. 

In the protocol, Alice creates a biphoton pair, keeps one photon for herself, and sends the other 
photon to Bob. Alice and Bob randomly switch between measurements in the temporal (n^ = 

= 1) and spectral {rit = = K) bases at intervals of T = 1/n. After a certain time, they 

publicly compare their basis choices and divide their measurements into three categories, in which 
they (i) both detected photons and measured in the same basis set, (ii) both detected photons and 
measured in different basis sets, and (iii) did not both measure a photon. They discard category 
(iii) measurements. Type (i) measurements should be perfectly correlated, providing Alice and Bob 
with the raw sifted key. Eve does not know in which basis Alice and Bob are observing, and will 
therefore measure in the wrong basis set half of the time. If, for example, Alice and Bob do spectral 
measurements and Eve does a temporal measurement, she spreads the photon pair in frequency 
and increases the error probability in the type-(i) measurements, revealing her presence to Alice 
and Bob. 

The use of two conjugate bases ensures security in the DWDM-QKD protocol. While measure- 
ments in these bases is practical for relatively small basis size, the demands on instruments become 
unrealistic for larger bases; for instance, generating the secure key at 10 bits per photon would 
require a minimum basis size of 1024, and therefore as many detectors (in a continuously running 
scheme). The temporal measurements present an additional a challenge because typical SPDC 
sources at 1550 nm produce photon pairs with cjcor ~ 1 ps for type-II phase-matched periodically 
poled KTiOP04 (PPKTP) {cjcor ^ 0.04 ps for type-0 phase-matched periodically poled LiNbOs 
(PPLN)), which corresponds to a bandwidth of ~4 nm (~100 nm). No detector exists to measure 
such short time bins continuously [T2^ . This timing mismatch between practical detectors and prac- 
tical sources implies that the realizable number of time bins rit < K. When Alice and Bob measure 
in the temporal domain, they cannot check arrival temporal correlations to their fundamental limit. 
For instance, if the detector jitter is cFdet ^ 30 ps, as for SNSPD detectors [7^, then rit/K ^ 1/30, 
as indicated in the temporal measurement in Fig. [l^. As a result, Alice and Bob reduce the dimen- 
sionality of communication in the temporal domain from the Schmidt number [8 , ~ CFcoh / ^cor to 
K' < (Jcoh/^deti and Eve can obtain finite spectral information without creating observable errors 
in the temporal basis. This example illustrates that in general, technological limitations reduce the 
number of basis states far below the fundamental limit. 

To solve this problem, Alice and Bob can employ a hybrid basis that constitutes a superposition 
of temporal and spectral states. They measure in the temporal basis with resolution aun and 
simultaneously in the spectral basis with resolution ((15^^)"^. In this case, the maximum number of 
time bins becomes rit = o'coh/o'bin and the number of spectral bins becomes = ounl^ycor so that 
the total alphabet size becomes ntn^^ = cFcoh/^con which recovers the original Schmidt number, K. 
Now photons are measured in the spectral and temporal basis simultaneously, as shown in Figs. [TJd 
andffli. 

The key generation rate depends on the phase-matching bandwidth, A^l, and the number of 
photon pairs available for transmission. Alice and Bob can choose to transmit a single pair over 
this bandwidth, or can split the spectrum into some number of channels, A/'c, each with photon flux, 
n/Nc. In both cases, the maximum key generation rate evaluates to 

R^n\og^^-^y (1) 
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FIG. 1: (a) The temporal-coding scheme. A strong laser pumps a nonlinear crystal. Photons pairs are 
generated by SPDC and sent across channels of equal length to Alice and Bob who measure their arrival 
times, (b) Time bins agreed upon by Alice and Bob over a public channel. If a photon pair is detected in 
a given time bin, then that character is shared between Alice and Bob. (c) Alice and Bob place a DWDM 
before their detectors to obtain spectral information, (d) The new two-dimensional state space. 



In Fig. |2^, we plot this relationship for two typical sources in the telecom band: a 1-cm type-II 
phase-matched PPKTP crystal generating photons pairs at 1550 nm with a 4 nm bandwidth; and 
a 2-cm type-0 phase- matched PPLN crystal at 1550 nm with a 100 nm bandwidth. Alice and Bob 
can generate a key at almost 20 bpp and 2 Gb/s using the PPLN source. 

A careful analysis must take into account the finite overlap of the basis states. When we 
include this overlap as well as the detector timing jitter, we can calculate the mutual informa- 
tion between Alice and Bob as I{A^B) = H{A) + H{B) — H{A^B), using the Shannon entropy, 

II A| and plot the results in Fig. \2Y 



H = — logp^^^, where {x} is the complete set of indices spanning a probability density 

function p. We evaluate /(A, B) in Appendix 



as a function of 

the number of Gaussian spectral channels, and the number of time bins. We use Gaussian channels 
to approximate modern DWDM filters. The continuous lines represent the ideal information per 
photon, and the data points represent our simulated results for the mutual information using a two- 
dimensional Gaussian, ^l^itA^ts) oc e-(^^-^^)^/'^^co.e-(^^+^s)'/4a2^he-^^p(^^+^s)/2, for the biphoton 
wave function, where Up is the pump frequency. For a small number of spectral channels, we see 
good agreement. For large numbers, the Gaussian filters slightly underperform the ideal result due 
to crosstalk in the closely spaced temporal and spectral bins. This is evident in Fig. for 32 
spectral channels with FWHM of {n^crcor)~^ and channel spacing 4:{n^acor)~^ ^ and two 40 ps time 
bins. 

Our formalism also enables us to study the effect of detector timing jitter. The results are plotted 
in the inset in Fig. and show that the mutual information drops rapidly when the timing jitter 
approaches the time bin duration. 

The security check employing conjugate bases in purely frequency and time relies on the mutu- 
ally unbiased nature of these bases; a measurement in the wrong basis reveals no information about 
the state in the other basis and by their conjugate nature introduces errors. We therefore seek a 
mutually unbiased basis to that employed in our resource-efficient scheme. Alice and Bob's coarse 
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FIG. 2: (a) Key exchange rate and bits per photon as a function of phase- matching bandwidth and photon 
flux, (b) Mutual information as a function of the number of spectral channels, Uu;. The individual spectral 
channels have bandwidth 6iy — Auj/riuj and spacing Adiy. Increasing the number of spectral channels increases 
the bits per photon, until the time duration of the filtered photon approaches atin- The inset shows mutual 
information as a function of detector timing jitter, adet, normalized to atin- 



measurements in spectrum are described by an operator that projects subsets of spectral states 
onto degenerate eigenvalues Qi. The degeneracy within these subsets is lifted by also performing 
measurements in time, which are described by an operator with coarse timing resolution that 
correspond to degenerate sets of eigenstates. Simultaneous eigenstates for time and spectral mea- 
surements \QiTm) describe one basis set. A conjugate basis can be found that forms the second 
basis for measurements by Alice and Bob. 

Under certain conditions, a security check can be performed using simple instrumentation. For 
now, we assume that Eve chooses to attack by using either a Gaussian envelope in time or one in 
frequency, i.e., Et = JZo e"''/'^"^^«^^' \t) {t\ dt [T or = /^^ e-(af,J^(^-^p/2)^ respec- 
tively. Eve's temporal measurement leads to a decrease in <Jco/i, and her frequency measurement 
creates an increase in the biphoton correlation time, acor- Alice and Bob can detect both of these 
attacks with the 'extended Franson interferometer' (eFI) shown in Fig. [s] The eFI is composed of 
two unbalanced Mach-Zehnder interferometers (MZI) in the possession of Alice and Bob, where the 
long path on one arm can be actively modulated. 

The probability for Alice and Bob to detect a photon coincidence in their eFI is 

Pc oc i + i cos[uj{2At - (5t)]e-^''/^"— e-^''/^"-S (2) 

where u = ujp/2 is the center frequency of the SPDC signal and idler photons. At is the path- length 
difference between the long and short arm of Alice's MZI, and 5t is the path-length difference 
between Alice's and Bob's long arm. At is large enough to avoid single photon interference between 
long and short paths of a single arm of the eFI, and St is varied on the order of l/cj about zero. The 
interference is plotted in Fig. [3] as a function of an additional delay in Alice's MZI. This interference 
curve shows the oscillations in Pc that is typical of the Franson interferometer near 5t = 0. In 
addition, this oscillation has a Gaussian envelope whose width is given by (icor- 

The visibility of the eFI interference is V = e""^^ /^c^corg-^^ l^^coh. If Eve measures in the 
temporal domain with a resolution better than At, then Alice and Bob can detect a drop in V 
near bt = 0; this is the security check used by Kahn et. al in Ref. [4 . On the other hand, if Eve 
measures in the spectral domain with a resolution better than AVt^ then Alice and Bob can detect 
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FIG. 3: The eFI used for security checks. Ahce switches the short arm of her Franson between lengths Sti 
and 6t2. This allows determination of both acoh and acor so that weak spectral and temporal measurements 
on the photon pair can be detected. Alice and Bob do security checks by varying 6t as shown in the insets. 
We show one possible switching scheme that makes use of Pockels cells (PC) to rotate the polarization of 
the photon by 7r/2 so that it is either transmitted or reflected at the polarizing beam splitter (PBS) and sent 
to the extended or standard delay line, respectively. The eFI also includes non-polarizing beam splitters 
(BS) and single photon detectors (D). 



an increase in V near 5t = acor- To guard against temporal and spectral measurements by Eve 
simultaneously, Alice and Bob measure V while Alice switches randomly between delays of and 
acor (see Fig. [s]). 

Alice and Bob can deduce the correlation time and coherence time from two visibility measure- 
ments Vi and V2 using two delays, Sti and St2^ respectively. We label these extrapolated values 
cr^^ and cr^^, which are given by 



1 Stj 



8 In 1/2 - In Vi 
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(4) 



derived from this measurement, 
J + log2 (cr^^/cTcor), which is the 
sum of her information obtained from temporal and spectral measurements. Our assumption of a 
Gaussian form of Eve's POVM will be generalized in future work. 



the bound on Eve's information per photon is Ie < \og2{(J coh / coh) 
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I. CONCLUSION 



The often limited photon budget for quantum key distribution makes high-dimensional encoding 
desirable. However, achieving the limit on this dimensionality in the temporal domain using 
time-frequency entangled photon pairs requires detectors with sub-ps timing jitter and resolution. 
By invoking conjugate spectral correlations, we present a protocol to approach this fundamental 
limit using current detectors and existing telecom networks. The conjugate nature of temporal and 
spectral encoding means that one can trade spectral for temporal bits (and vice versa) to minimize 
the effect of channel distortion such as nonlinear frequency conversion and dispersion, in addition 
to optimizing over transmission rate and channel bandwidth. 

This work was supported by the DARPA Information in a Photon program, through grant 
W911NF-10-1-0416 from the Army Research Office. 



II. METHODS 



A. Mutual information 



Alice and Bob ideally communicate information by discretizing the wave function into agreed- 
upon time-bin |cr^^^) and frequency-bin macrostates by 



i,j,k,l 



where 



ijkl 



FTo 



J k6u J I6u 



llj{uJA,(^B)duJAduJB 



dtAdtb 



(5) 



(6) 



The probability of Alice and Bob projecting into time bins |cr^-^ ^) and |cr^.^ ^) and frequency 



bins \u\) and |z/^) is p 



bin ' 



I = |G*'-^'^'^p. We label the frequency bins so 



that for = /, the center frequencies of these bins add to the pump frequency. We plot the mutual 
information in Fig. as a function of the number of spectral channels added. The wave function is a 
two-dimensional Gaussian. As we increase the number of spectral channels, the mutual information 
(MI) increases, however the timing correlations eventually start to decrease, as the filtered photons 
extend into neighboring time bins. Jitter is also a very important to the MI calculation. We include 
this in the inset to Fig. [2b. 



B. Detector timing jitter 



Detector timing jitter refers to the added uncertainty in the photon detection time of some 
stimulus, purely a result of detector electronics. Superconducting nanowire single photon detectors 
and InGaAs APDs both exhibit jitter of roughly 30 to 40 ps [10 . We model timing jitter as a 
Gaussian projection, a^et = J e~^^/^^^et ^^^^^|^^^ xhe jitter proffie of a real photodetector 
is not truly Gaussian and can be quite asymmetric, however (1) this model allows for first-order 
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analysis and (2) certain single photon detectors do have approximately Gaussian timing jitter [71. 
If we apply adet on both Alice and Bob's photons, assuming the two-dimensional Gaussian given 
earlier, we get 



/oo nOO 
/ exp 
-oo J — oo 



-{tA+tB) 



2 1 



exp 



2 1 



(7) 

Since a coh ^ (^dei^ the most important effect of jitter is to increase the observed correlation time 
roughly from Gcor to Gdet- This can have a significant effect on the mutual information between 
Alice and Bob if Gdet is on the order of aun^ as shown in Fig. l2b. 



III. SUPPLEMENTARY INFORMATION 

A. Lossy Franson interferometry 

The Franson interference derived in the text assumes lossless propagation through the interferom- 
eter. This assumption is not valid in photonic integrated chips or fiber networks. We can account 
for loss in our analysis by adding a virtual beam splitter in the long path of the otherwise-lossless 
Franson, which couples the waveguide mode with a vacuum mode (see Fig. [4|. We work in the 
Heisenberg construction, evolving the annihilation operator through the virtual-loss beam splitter 
and the two Franson beam splitters. The matrix for beam splitters 1 and 2, which leave the third 
mode undisturbed is given by 




= VT^^ -Vn I (8) 
\ 

where i G 1,2. The virtual-loss beam splitter is given by 

Ul= \ Vtl I (9) 




The resulting annihilation operators are then dA{tA) — Cia(t) + C2a(t — At) and aB{tB) = 
Cid{t) -\- C2a{t — At — 5t) ^ disregarding the vacuum term, which will not affect coincidence counting. 
Ci = ^/rl^/r2 and C2 = ~ ^1 VI ~ ^2>Al- For n = r2 = 1/2, and = e"^*/'^" where Tq, is the 
lifetime of the photon in the interferometer arm, the visibility simplifies to 

Vpic - Y^^ziA^^ -e (10) 



However for maximum visibility, Ci = C2, so 



= VtZ. (11) 



The Franson beam splitters can therefore be tuned to account for loss in the interferometer. 
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FIG. 4: The eFI with an additional virtual beam splitter for loss in the long arm. 



B. Eve and the wave function 

We focus on the case of a single eavesdropper measuring a single photon of the photon pair. Eve's 
temporal measurement is a Gaussian filtering function 



Et 



f 

J — c 



\t) {t\ dt 



Following [4 , the amplitude function 

^{tA,tB) CX exp[-(t^ - tB)V^CTl,r] eM-tll '^^lohV'^'^'^^'^'' '\ 

for Gcoh ^ ^cor- Therefore 



(12) 



(13) 



(14) 
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exp 



4cr2 



^iuJp{tA-\-tB)/'2 



\tA,tB) 



SO the coherence time of the biphoton packet is strongly influenced by Eve's timing resolution when 
^coh ^ ^coh' Similarly, we define a weak spectral POVM, 

\u) {uj\duj (15) 



r 

J — ( 



For l/acor ^ 1^) can be written in the spectral-domain representation as follows 

1^) OC y J exp[-cr^^^/4(2cjA - cj^)^] exp[-cr^^^(cjA + -^p)^] \uja,^b) dujAduJB, (16) 
from which we find that 

1^) ^ / / exp[-(aL/4 + {af,,f /4){2uja - uJ^f] (17) 



X exp[-cr^^^(cjA + - ^p)^] \^a,^b) dujAduj 



B- 
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Thus, Eve projects the biphoton pair onto a narrower frequency distribution. Reverting to the 
time-domain representation we get 

l"^)^ J J eM-tl/'^^coh) eM-{tA - tB)y^cTg,)'y^-^'-^'-^/' \tA^ ts) dtAdtB^ (18) 

for a cor < CF^or < ^coh- 
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